Network analysis systems analyze data about the amount of application data that has been acknowledged by end points in a network flow. When network traffic is transported using an unencrypted transport protocol, such as transmission control protocol (TCP), information in the packet headers can indicate the amount of application data that has been acknowledged by the end points. For example, information stored in the SEQ and ACK packet headers can provide such information. However, when network traffic is transported using an encrypted transport protocol, without decryption of the packet headers, such information is inaccessible. In many scenarios, decryption is not an option.
Such conventional methods and systems have generally been considered satisfactory for their intended purpose. However, there is still a need in the art for estimation of an amount of acknowledgement application data when an encrypted transport protocol is used.